@boyingliu01/xp-gate 0.13.2 → 0.14.0

package/bin/xp-gate.js

@@ -157,6 +157,14 @@ const COMMANDS = {
       }
     },
     usage: 'xp-gate update-hooks [--global] [--force] [--dry-run] [--no-backup] [--scope hooks|adapters|all]'
+  },
+  'install': {
+    description: 'One-step install (init + bootstrap + doctor)',
+    run: subargs => {
+      const { install } = require('../lib/install-cmd');
+      install(subargs).then(code => process.exit(code));
+    },
+    usage: 'xp-gate install [--global]'
   }
 };
 

package/gate-9.sh

@@ -1,14 +1,14 @@
 # ============================================================================
-# GATE 10: Semgrep SAST Security Scan
+# GATE 9: Semgrep SAST Security Scan
 # Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
 # Tool: semgrep -- https://semgrep.dev
 # ============================================================================
 
  2>&1 echo ""
- 2>&1 echo "→ Gate 10: Semgrep SAST Security Scan..."
-GATE_10_START=$(gate_start_ms)
+ 2>&1 echo "→ Gate 9: Semgrep SAST Security Scan..."
+GATE_9_START=$(gate_start_ms)
 
-GATE_10_STATUS=""
+GATE_9_STATUS=""
 
 # Semgrep availability check
 SEMGREP_CMD=""
@@ -22,15 +22,15 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     ⚠️  WARN - semgrep not installed — SAST scanning unavailable"
   echo "     Install: brew install semgrep (macOS) | pip install semgrep (Linux) | pip install semgrep (Windows)"
   echo "     Pre-cache rules: semgrep --config=p/security-audit"
-  echo "     Gate 10: SAST Security (WARN, semgrep not installed)"
-  GATE_10_STATUS="WARN"
+  echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
+  GATE_9_STATUS="WARN"
 else
   # Get staged files filtered to Semgrep-supported languages
   SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
-    GATE_10_STATUS="SKIP"
+    GATE_9_STATUS="SKIP"
   else
     # Run semgrep with JSON output
     # --config=p/security-audit: explicit security ruleset
@@ -41,7 +41,7 @@ else
 
     if [ "$SEMGREP_EXIT" -eq 0 ]; then
       echo "     ✅ PASSED - No security vulnerabilities found."
-      GATE_10_STATUS="PASS"
+      GATE_9_STATUS="PASS"
     elif [ "$SEMGREP_EXIT" -eq 1 ]; then
       # Findings detected - parse JSON to categorize
       CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | python3 -c "
@@ -99,7 +99,7 @@ except:
       if [ "$CRITICAL_HIGH" -gt 0 ]; then
         echo ""
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "   GATE 10: Semgrep Security Gate"
+        echo "   GATE 9: Semgrep Security Gate"
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
         echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
         echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
@@ -108,7 +108,7 @@ except:
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
         echo "$FINDING_DETAILS"
         echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
-        GATE_10_STATUS="FAIL"
+        GATE_9_STATUS="FAIL"
         exit 1
       else
         echo ""
@@ -117,14 +117,14 @@ except:
           echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
           echo "$FINDING_DETAILS"
         fi
-        GATE_10_STATUS="PASS"
+        GATE_9_STATUS="PASS"
       fi
     else
       # semgrep runtime error (timeout, config error, etc.)
       echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
-      GATE_10_STATUS="SKIP"
+      GATE_9_STATUS="SKIP"
     fi
   fi
 fi
-record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"
+record_gate_audit "gate-9" "sast-security" "$GATE_9_STATUS" "0" "$GATE_9_START"

package/hooks/gate-9.sh

@@ -1,14 +1,14 @@
 # ============================================================================
-# GATE 10: Semgrep SAST Security Scan
+# GATE 9: Semgrep SAST Security Scan
 # Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
 # Tool: semgrep -- https://semgrep.dev
 # ============================================================================
 
  2>&1 echo ""
- 2>&1 echo "→ Gate 10: Semgrep SAST Security Scan..."
-GATE_10_START=$(gate_start_ms)
+ 2>&1 echo "→ Gate 9: Semgrep SAST Security Scan..."
+GATE_9_START=$(gate_start_ms)
 
-GATE_10_STATUS=""
+GATE_9_STATUS=""
 
 # Semgrep availability check
 SEMGREP_CMD=""
@@ -22,15 +22,15 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     ⚠️  WARN - semgrep not installed — SAST scanning unavailable"
   echo "     Install: brew install semgrep (macOS) | pip install semgrep (Linux) | pip install semgrep (Windows)"
   echo "     Pre-cache rules: semgrep --config=p/security-audit"
-  echo "     Gate 10: SAST Security (WARN, semgrep not installed)"
-  GATE_10_STATUS="WARN"
+  echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
+  GATE_9_STATUS="WARN"
 else
   # Get staged files filtered to Semgrep-supported languages
   SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
-    GATE_10_STATUS="SKIP"
+    GATE_9_STATUS="SKIP"
   else
     # Run semgrep with JSON output
     # --config=p/security-audit: explicit security ruleset
@@ -41,7 +41,7 @@ else
 
     if [ "$SEMGREP_EXIT" -eq 0 ]; then
       echo "     ✅ PASSED - No security vulnerabilities found."
-      GATE_10_STATUS="PASS"
+      GATE_9_STATUS="PASS"
     elif [ "$SEMGREP_EXIT" -eq 1 ]; then
       # Findings detected - parse JSON to categorize
       CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | python3 -c "
@@ -99,7 +99,7 @@ except:
       if [ "$CRITICAL_HIGH" -gt 0 ]; then
         echo ""
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "   GATE 10: Semgrep Security Gate"
+        echo "   GATE 9: Semgrep Security Gate"
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
         echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
         echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
@@ -108,7 +108,7 @@ except:
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
         echo "$FINDING_DETAILS"
         echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
-        GATE_10_STATUS="FAIL"
+        GATE_9_STATUS="FAIL"
         exit 1
       else
         echo ""
@@ -117,14 +117,14 @@ except:
           echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
           echo "$FINDING_DETAILS"
         fi
-        GATE_10_STATUS="PASS"
+        GATE_9_STATUS="PASS"
       fi
     else
       # semgrep runtime error (timeout, config error, etc.)
       echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
-      GATE_10_STATUS="SKIP"
+      GATE_9_STATUS="SKIP"
     fi
   fi
 fi
-record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"
+record_gate_audit "gate-9" "sast-security" "$GATE_9_STATUS" "0" "$GATE_9_START"

package/lib/__tests__/bootstrap.test.js

@@ -0,0 +1,78 @@
+const { bootstrap } = require('../bootstrap.js');
+
+describe('bootstrap', () => {
+  let consoleLogSpy;
+
+  beforeEach(() => {
+    consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('returns 0 when --dry-run given with no missing tools', () => {
+    vi.mock('../detect-deps.js', () => ({
+      GATE_CLI_TOOLS: [],
+      checkCliTool: () => ({ available: true }),
+      getToolInstallCmd: () => 'echo done',
+    }));
+
+    const { bootstrap } = require('../bootstrap.js');
+    const code = bootstrap(['--dry-run']);
+    expect(code).toBe(0);
+    vi.restoreAllMocks();
+  });
+
+  it('returns 0 when all CLI tools are available', () => {
+    vi.mock('../detect-deps.js', () => ({
+      GATE_CLI_TOOLS: [{ tool: 'testtool', gates: ['Gate 1'], install: { linux: 'echo ok' } }],
+      checkCliTool: () => ({ available: true, version: '1.0' }),
+      getToolInstallCmd: () => 'echo ok',
+    }));
+
+    const { bootstrap } = require('../bootstrap.js');
+    const code = bootstrap([]);
+    expect(code).toBe(0);
+    vi.restoreAllMocks();
+  });
+
+  it('accepts --lang ts parameter', () => {
+    vi.mock('../detect-deps.js', () => ({
+      GATE_CLI_TOOLS: [],
+      checkCliTool: () => ({ available: true }),
+      getToolInstallCmd: () => 'echo done',
+    }));
+
+    const { bootstrap } = require('../bootstrap.js');
+    const code = bootstrap(['--lang', 'ts']);
+    expect(code).toBe(0);
+    vi.restoreAllMocks();
+  });
+
+  it('accepts --lang ts,py parameter', () => {
+    vi.mock('../detect-deps.js', () => ({
+      GATE_CLI_TOOLS: [],
+      checkCliTool: () => ({ available: true }),
+      getToolInstallCmd: () => 'echo done',
+    }));
+
+    const { bootstrap } = require('../bootstrap.js');
+    const code = bootstrap(['--lang', 'ts,py']);
+    expect(code).toBe(0);
+    vi.restoreAllMocks();
+  });
+
+  it('recognizes --verbose flag without error', () => {
+    vi.mock('../detect-deps.js', () => ({
+      GATE_CLI_TOOLS: [],
+      checkCliTool: () => ({ available: true }),
+      getToolInstallCmd: () => 'echo done',
+    }));
+
+    const { bootstrap } = require('../bootstrap.js');
+    const code = bootstrap(['--verbose']);
+    expect(code).toBe(0);
+    vi.restoreAllMocks();
+  });
+});

package/lib/__tests__/detect-deps.test.js

@@ -413,6 +413,94 @@ describe('detect-deps', () => {
 
   // ── checkCliTool tests (Issue #299 — Windows cross-platform) ──
 
+  describe('GATE_TOOLS classification', () => {
+    it('exports GATE_TOOLS with required categories', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      expect(GATE_TOOLS.PLATFORM).toEqual(expect.arrayContaining(['jscpd', 'lizard', 'semgrep', 'gitleaks', 'npx']));
+      expect(GATE_TOOLS.IAC).toEqual(expect.arrayContaining(['checkov', 'hadolint', 'kube-score', 'tflint']));
+      expect(GATE_TOOLS.LANG_MAP.ts).toBe('typescript');
+      expect(GATE_TOOLS.LANG_MAP.py).toBe('python');
+    });
+
+    it('has LINT entries for all 12 supported languages', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      expect(Object.keys(GATE_TOOLS.LINT).sort()).toEqual([
+        'cpp', 'dart', 'flutter', 'go', 'java', 'kotlin',
+        'objectivec', 'powershell', 'python', 'shell', 'swift', 'typescript',
+      ]);
+    });
+
+    it('has TEST entries for major languages', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      expect(GATE_TOOLS.TEST.typescript).toContain('vitest');
+      expect(GATE_TOOLS.TEST.python).toContain('pytest');
+      expect(GATE_TOOLS.TEST.go).toContain('go');
+    });
+
+    it('has MUTATION entries for languages with mutation support', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      expect(GATE_TOOLS.MUTATION.typescript).toContain('stryker');
+      expect(GATE_TOOLS.MUTATION.python).toContain('mutmut');
+      expect(GATE_TOOLS.MUTATION.go).toContain('gomutants');
+      expect(GATE_TOOLS.MUTATION.java).toContain('pitest');
+    });
+
+    it('has SPECIAL with jq, tsx, node descriptors', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      expect(GATE_TOOLS.SPECIAL.jq.gate).toBe('MW');
+      expect(GATE_TOOLS.SPECIAL.tsx.gate).toContain('M');
+      expect(GATE_TOOLS.SPECIAL.node.gate).toContain('0');
+    });
+
+    it('LANG_MAP values all exist as LINT keys', () => {
+      const { GATE_TOOLS } = require('../detect-deps');
+      const lintKeys = Object.keys(GATE_TOOLS.LINT);
+      for (const full of Object.values(GATE_TOOLS.LANG_MAP)) {
+        expect(lintKeys).toContain(full);
+      }
+    });
+  });
+
+  describe('detectProjectLang', () => {
+    it('returns empty array for project with no known markers', () => {
+      const { detectProjectLang } = require('../detect-deps');
+      expect(detectProjectLang(tmpHome)).toEqual([]);
+    });
+
+    it('detects typescript from tsconfig.json', () => {
+      fs.writeFileSync(path.join(tmpHome, 'tsconfig.json'), '{}');
+      const { detectProjectLang } = require('../detect-deps');
+      expect(detectProjectLang(tmpHome)).toContain('typescript');
+    });
+
+    it('detects python from pyproject.toml', () => {
+      fs.writeFileSync(path.join(tmpHome, 'pyproject.toml'), '[project]\n');
+      const { detectProjectLang } = require('../detect-deps');
+      expect(detectProjectLang(tmpHome)).toContain('python');
+    });
+
+    it('detects go from go.mod', () => {
+      fs.writeFileSync(path.join(tmpHome, 'go.mod'), 'module example.com/m\n');
+      const { detectProjectLang } = require('../detect-deps');
+      expect(detectProjectLang(tmpHome)).toContain('go');
+    });
+
+    it('detects java from pom.xml', () => {
+      fs.writeFileSync(path.join(tmpHome, 'pom.xml'), '<project></project>');
+      const { detectProjectLang } = require('../detect-deps');
+      expect(detectProjectLang(tmpHome)).toContain('java');
+    });
+
+    it('detects multiple languages in monorepo', () => {
+      fs.writeFileSync(path.join(tmpHome, 'package.json'), JSON.stringify({ devDependencies: { typescript: '^5.0.0' } }));
+      fs.writeFileSync(path.join(tmpHome, 'go.mod'), 'module example.com/m\n');
+      const { detectProjectLang } = require('../detect-deps');
+      const langs = detectProjectLang(tmpHome);
+      expect(langs).toContain('typescript');
+      expect(langs).toContain('go');
+    });
+  });
+
   describe('checkCliTool', () => {
     const { execSync: realExecSync } = require('child_process');
 

package/lib/__tests__/doctor.test.js

@@ -931,4 +931,32 @@ describe('doctor', () => {
     const currentContent = fs.readFileSync(path.join(projectAdaptersDir(), 'gate-3.sh'), 'utf8');
     expect(currentContent).toBe(originalContent);
   });
+
+  it('--format json returns valid JSON with tools field', async () => {
+    setupLocalInstall();
+    seedVersionCache();
+    mockExecSuccess();
+    const { doctor } = require('../doctor');
+    const { formatDoctorJson } = require('../doctor');
+
+    const checks = [
+      { name: 'CLI tool: jscpd (Gate 2)', status: 'PASS', detail: 'v0.3.5' },
+      { name: 'CLI tool: lizard (Gate 3)', status: 'WARN', detail: 'Not found' },
+    ];
+    const json = formatDoctorJson(checks, 1);
+    expect(json.ok).toBe(false);
+    expect(json.issues).toBe(1);
+    expect(json.checks).toHaveLength(2);
+    expect(json.missing_tools).toBeDefined();
+  });
+
+  it('--format json returns ok:true when no issues', async () => {
+    const { formatDoctorJson } = require('../doctor');
+    const checks = [
+      { name: 'CLI tool: jscpd (Gate 2)', status: 'PASS', detail: 'v0.3.5' },
+    ];
+    const json = formatDoctorJson(checks, 0);
+    expect(json.ok).toBe(true);
+    expect(json.issues).toBe(0);
+  });
 });

package/lib/__tests__/install-cmd.test.js

@@ -0,0 +1,41 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+describe('install-cmd', () => {
+  let tmpDir;
+  let consoleLogSpy;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-install-'));
+    consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    vi.restoreAllMocks();
+  });
+
+  it('exports install function', () => {
+    const { install } = require('../install-cmd');
+    expect(typeof install).toBe('function');
+  });
+
+  it('install accepts --global flag', async () => {
+    const { install } = require('../install-cmd');
+    const code = await install(['--global'], tmpDir);
+    expect(typeof code).toBe('number');
+  });
+
+  it('install runs without --global (local mode) in git repo', async () => {
+    // Simulate git repo
+    const gitDir = path.join(tmpDir, '.git');
+    fs.mkdirSync(gitDir, { recursive: true });
+    fs.mkdirSync(path.join(gitDir, 'hooks'), { recursive: true });
+
+    const { install } = require('../install-cmd');
+    const code = await install([], tmpDir);
+    expect(typeof code).toBe('number');
+  });
+});

package/lib/__tests__/uninstall.test.js

@@ -623,4 +623,57 @@ describe('uninstall', () => {
     // After successful uninstall, backup should be cleaned up
     expect(fs.existsSync(backupDir())).toBe(false);
   });
+
+  it('--purge in global mode removes ~/.xp-gate/ and ~/.config/xp-gate/ config dir', async () => {
+    setupGlobalInstall();
+    const expectedHooksPath = globalHooksDir();
+
+    const xpGateDir = path.join(tmpHome, '.xp-gate');
+    fs.mkdirSync(path.join(xpGateDir, 'reports', 'pre-commit'), { recursive: true });
+    fs.writeFileSync(path.join(xpGateDir, 'reports', 'pre-commit', 'test.json'), '{}');
+
+    mockExecGlobalHooksPath(expectedHooksPath);
+    const { uninstall } = require('../uninstall');
+
+    const result = await uninstall(['--purge']);
+
+    expect(result).toBe(0);
+    expect(fs.existsSync(xpGateDir)).toBe(false);
+    expect(fs.existsSync(path.join(tmpHome, '.config', 'xp-gate'))).toBe(false);
+  });
+
+  it('--purge in local mode removes project and global .xp-gate/ dirs', async () => {
+    setupLocalInstall();
+
+    const projectXpGate = path.join(tmpProject, '.xp-gate');
+    fs.mkdirSync(path.join(projectXpGate, 'quality-status'), { recursive: true });
+    fs.writeFileSync(path.join(projectXpGate, 'quality-status', 'main.json'), '{}');
+
+    const globalXpGate = path.join(tmpHome, '.xp-gate');
+    fs.mkdirSync(path.join(globalXpGate, 'reports', 'pre-commit'), { recursive: true });
+    fs.writeFileSync(path.join(globalXpGate, 'reports', 'pre-commit', 'test.json'), '{}');
+
+    mockExecSuccess();
+    const { uninstall } = require('../uninstall');
+
+    const result = await uninstall(['--purge']);
+
+    expect(result).toBe(0);
+    expect(fs.existsSync(projectXpGate)).toBe(false);
+    expect(fs.existsSync(globalXpGate)).toBe(false);
+    expect(fs.existsSync(path.join(tmpHome, '.config', 'xp-gate'))).toBe(false);
+  });
+
+  it('--purge --dry-run prints purge plan without deleting', async () => {
+    setupGlobalInstall();
+    mockExecGlobalHooksPath(globalHooksDir());
+    const { uninstall } = require('../uninstall');
+
+    const result = await uninstall(['--purge', '--dry-run']);
+
+    expect(result).toBe(0);
+    expect(fs.existsSync(globalHooksDir())).toBe(true);
+    expect(fs.existsSync(globalAdaptersDir())).toBe(true);
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Purge'));
+  });
 });

package/lib/detect-deps.js

@@ -518,4 +518,6 @@ module.exports = {
   GATE_CLI_TOOLS,
   checkCliTool,
   getToolInstallCmd,
+  GATE_TOOLS: require('./gate-tools.js').GATE_TOOLS,
+  detectProjectLang: require('./gate-tools.js').detectProjectLang,
 };

package/lib/doctor.js

@@ -804,6 +804,18 @@ async function doctor(args) {
   return issues > 0 ? 1 : 0;
 }
 
+function formatDoctorJson(checks, issues) {
+  const missing_tools = checks
+    .filter(c => c.status === 'WARN' || c.status === 'FAIL')
+    .map(c => ({ name: c.name, detail: c.detail }));
+  return {
+    ok: issues === 0,
+    issues,
+    checks: checks.map(c => ({ name: c.name, status: c.status, detail: c.detail })),
+    missing_tools,
+  };
+}
+
 module.exports = {
   doctor, isXpGateFile, SIGNATURES,
   fixVersionMismatch,
@@ -815,4 +827,5 @@ module.exports = {
   fixTuiRegistration,
   ensureTuiRegistration,
   readTuiJson,
+  formatDoctorJson,
 };

package/lib/gate-tools.js

@@ -0,0 +1,87 @@
+const fs = require('fs');
+const path = require('path');
+
+const GATE_TOOLS = {
+  PLATFORM: ['jscpd', 'lizard', 'semgrep', 'gitleaks', 'npx'],
+  IAC: ['checkov', 'hadolint', 'kube-score', 'tflint'],
+
+  LANG_MAP: {
+    ts: 'typescript', py: 'python', go: 'go', java: 'java',
+    kt: 'kotlin', cpp: 'cpp', swift: 'swift', dart: 'dart',
+    flutter: 'flutter', sh: 'shell', ps: 'powershell', objc: 'objectivec',
+  },
+
+  LINT: {
+    typescript: ['biome', 'eslint', 'tsc'],
+    python: ['ruff', 'flake8', 'mypy', 'black', 'isort'],
+    go: ['golangci-lint', 'go'],
+    java: ['checkstyle', 'pmd'],
+    kotlin: ['ktlint', 'detekt'],
+    cpp: ['clang-tidy', 'cppcheck', 'cmake'],
+    swift: ['swiftlint', 'swift'],
+    dart: ['dart'],
+    flutter: ['flutter'],
+    shell: ['shellcheck'],
+    powershell: ['pwsh'],
+    objectivec: ['oclint'],
+  },
+
+  TEST: {
+    typescript: ['vitest', 'jest'],
+    python: ['pytest'],
+    go: ['go'],
+    java: ['mvn', 'gradle'],
+    kotlin: ['mvn', 'gradle'],
+    swift: ['swift'],
+    cpp: ['ctest', 'gcovr'],
+    dart: ['dart'],
+    flutter: ['flutter'],
+  },
+
+  MUTATION: {
+    typescript: ['stryker'],
+    python: ['mutmut'],
+    go: ['gomutants'],
+    java: ['pitest'],
+  },
+
+  SPECIAL: {
+    jq: { gate: 'MW', desc: 'code-walkthrough JSON parser (mandatory)' },
+    tsx: { gate: 'M/M3/4/6', desc: 'TypeScript executor (via npx)' },
+    node: { gate: '0/4/6/M/M3', desc: 'All TypeScript gate runtime' },
+  },
+};
+
+const LANG_MARKERS = [
+  { file: 'tsconfig.json', lang: 'typescript' },
+  { file: 'package.json', check: (p) => {
+    try {
+      const json = JSON.parse(fs.readFileSync(p, 'utf8'));
+      return !!(json.devDependencies && json.devDependencies.typescript)
+        || !!(json.dependencies && json.dependencies.typescript);
+    } catch { return false; }
+  }, lang: 'typescript' },
+  { file: 'go.mod', lang: 'go' },
+  { file: 'pyproject.toml', lang: 'python' },
+  { file: 'manage.py', lang: 'python' },
+  { file: 'requirements.txt', lang: 'python' },
+  { file: 'pom.xml', lang: 'java' },
+  { file: 'build.gradle', lang: 'java' },
+  { file: 'build.gradle.kts', lang: 'kotlin' },
+  { file: 'pubspec.yaml', lang: 'flutter' },
+  { file: 'CMakeLists.txt', lang: 'cpp' },
+  { file: 'Package.swift', lang: 'swift' },
+];
+
+function detectProjectLang(projectRoot) {
+  const found = new Set();
+  const exists = (f) => fs.existsSync(path.join(projectRoot, f));
+  for (const marker of LANG_MARKERS) {
+    if (!exists(marker.file)) continue;
+    if (marker.check && !marker.check(path.join(projectRoot, marker.file))) continue;
+    found.add(marker.lang);
+  }
+  return [...found];
+}
+
+module.exports = { GATE_TOOLS, detectProjectLang };

package/lib/init.js

@@ -2,6 +2,7 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { checkDeps, checkBash, autoInstallDeps, detectPlatform, GATE_CLI_TOOLS, checkCliTool } = require('./detect-deps.js');
+const { copyHooks, copyAdapters } = require('./shared-utils.js');
 const {
   HOME_DIR,
   CONFIG_DIR,
@@ -11,42 +12,6 @@ const {
   GLOBAL_ADAPTERS_DIR,
 } = require('./shared-paths.js');
 
-function copyHooks(srcDir, destDir) {
-  ['pre-commit', 'pre-push'].forEach(hook => {
-    const src = path.join(srcDir, 'hooks', hook);
-    const dest = path.join(destDir, hook);
-    if (fs.existsSync(src)) {
-      fs.copyFileSync(src, dest);
-      fs.chmodSync(dest, 0o755);
-    }
-  });
-}
-
-function copyAdapters(srcDir, destDir) {
-  const adapterSrc = path.join(srcDir, 'adapter-common.sh');
-  if (fs.existsSync(adapterSrc)) {
-    fs.copyFileSync(adapterSrc, path.join(destDir, 'adapter-common.sh'));
-  }
-  const adaptersDir = path.join(srcDir, 'adapters');
-  if (fs.existsSync(adaptersDir)) {
-    fs.readdirSync(adaptersDir).forEach(f => {
-      if (f.endsWith('.sh')) {
-        fs.copyFileSync(path.join(adaptersDir, f), path.join(destDir, f));
-      }
-    });
-  }
-  // Copy gate scripts (gate-*.sh) from githooks/ source-of-truth to destDir.
-  // These are sourced by pre-commit via GATE_DIR which resolves to the adapter dir.
-  const githooksDir = path.resolve(srcDir, '..', '..', '..', 'githooks');
-  if (fs.existsSync(githooksDir)) {
-    fs.readdirSync(githooksDir).forEach(f => {
-      if (f.startsWith('gate-') && f.endsWith('.sh')) {
-        fs.copyFileSync(path.join(githooksDir, f), path.join(destDir, f));
-      }
-    });
-  }
-}
-
 function copyRecursive(src, dest) {
   const stat = fs.statSync(src);
   if (stat.isDirectory()) {

package/lib/install-cmd.js

@@ -0,0 +1,57 @@
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+const { copyHooks, copyAdapters } = require('./shared-utils');
+
+async function install(args = [], cwd = process.cwd()) {
+  const isGlobal = args.includes('--global');
+
+  if (isGlobal) {
+    return setupGlobal(cwd);
+  }
+  return setupLocal(cwd);
+}
+
+function setupGlobal(cwd) {
+  const srcDir = path.dirname(__dirname);
+
+  const globalHooksDir = path.join(require('os').homedir(), '.config', 'xp-gate', 'hooks');
+  const globalAdaptersDir = path.join(require('os').homedir(), '.config', 'xp-gate', 'adapters');
+
+  fs.mkdirSync(globalHooksDir, { recursive: true });
+  fs.mkdirSync(globalAdaptersDir, { recursive: true });
+
+  copyHooks(srcDir, globalHooksDir);
+  copyAdapters(srcDir, globalAdaptersDir);
+
+  try {
+    execSync(`git config --global core.hooksPath "${globalHooksDir}"`, { stdio: 'pipe' });
+  } catch (err) {
+    console.warn(`  Warning: Could not set global core.hooksPath: ${err.message}`);
+  }
+
+  console.log('Global installation complete.');
+  return 0;
+}
+
+function setupLocal(projectRoot) {
+  const gitDir = path.join(projectRoot, '.git');
+  if (!fs.existsSync(gitDir)) {
+    console.error('Error: Not a git repository');
+    return 1;
+  }
+
+  const srcDir = path.dirname(__dirname);
+  const hooksDir = path.join(gitDir, 'hooks');
+  const githooksDir = path.join(projectRoot, 'githooks');
+
+  copyHooks(srcDir, hooksDir);
+
+  fs.mkdirSync(path.join(githooksDir, 'adapters'), { recursive: true });
+  copyAdapters(srcDir, githooksDir);
+
+  console.log('Local installation complete.');
+  return 0;
+}
+
+module.exports = { install };

package/lib/shared-utils.js

@@ -33,4 +33,38 @@ function readXpGateConfig() {
   }
 }
 
-module.exports = { copyDirRecursive, readXpGateConfig };
+function copyHooks(srcDir, destDir) {
+  ['pre-commit', 'pre-push'].forEach(hook => {
+    const src = path.join(srcDir, 'hooks', hook);
+    const dest = path.join(destDir, hook);
+    if (fs.existsSync(src)) {
+      fs.copyFileSync(src, dest);
+      fs.chmodSync(dest, 0o755);
+    }
+  });
+}
+
+function copyAdapters(srcDir, destDir) {
+  const adaptersDir = path.join(srcDir, 'adapters');
+  const adapterCommon = path.join(srcDir, 'adapter-common.sh');
+  if (fs.existsSync(adapterCommon)) {
+    fs.copyFileSync(adapterCommon, path.join(destDir, 'adapter-common.sh'));
+  }
+  if (fs.existsSync(adaptersDir)) {
+    fs.readdirSync(adaptersDir).forEach(f => {
+      if (f.endsWith('.sh')) {
+        fs.copyFileSync(path.join(adaptersDir, f), path.join(destDir, f));
+      }
+    });
+  }
+  const githooksDir = path.resolve(srcDir, '..', '..', '..', 'githooks');
+  if (fs.existsSync(githooksDir)) {
+    fs.readdirSync(githooksDir).forEach(f => {
+      if (f.startsWith('gate-') && f.endsWith('.sh')) {
+        fs.copyFileSync(path.join(githooksDir, f), path.join(destDir, f));
+      }
+    });
+  }
+}
+
+module.exports = { copyDirRecursive, readXpGateConfig, copyHooks, copyAdapters };

package/lib/uninstall.js

@@ -331,7 +331,8 @@ async function uninstall(args) {
     dryRun: args.includes('--dry-run'),
     force: args.includes('--force'),
     forceLocal: args.includes('--local'),
-    forceGlobal: args.includes('--global')
+    forceGlobal: args.includes('--global'),
+    purge: args.includes('--purge'),
   };
 
   // §4.3 Step 1: Read config
@@ -362,7 +363,23 @@ async function uninstall(args) {
   // §4.3 Step 3: Build uninstall plan
   const plan = buildPlan(mode);
 
-  if (plan.length === 0) {
+  // §4.3 Step 3b: Add purge items if --purge
+  const purgeDirs = [];
+  if (options.purge) {
+    const configDir = CONFIG_DIR;
+    const xpGateDir = path.join(HOME_DIR, '.xp-gate');
+    purgeDirs.push({ label: '~/.xp-gate/', path: xpGateDir });
+    purgeDirs.push({ label: '~/.config/xp-gate/', path: configDir });
+    if (mode === 'local') {
+      const gitDir = getGitDir();
+      if (gitDir) {
+        const projectXpGate = path.join(path.dirname(gitDir), '.xp-gate');
+        purgeDirs.push({ label: '.xp-gate/ (project)', path: projectXpGate });
+      }
+    }
+  }
+
+  if (plan.length === 0 && purgeDirs.length === 0) {
     console.log('Nothing to uninstall');
     // Still update config to uninstalled
     saveConfig({ ...config, mode: 'uninstalled', uninstalled: new Date().toISOString() });
@@ -377,6 +394,12 @@ async function uninstall(args) {
   for (const item of plan) {
     console.log(`  • ${item.label}`);
   }
+  if (options.purge) {
+    console.log('\nPurge mode — additional cleanup:');
+    for (const d of purgeDirs) {
+      console.log(`  • ${d.label}`);
+    }
+  }
 
   // §4.3 Step 5: Dry-run → exit
   if (options.dryRun) {
@@ -406,14 +429,36 @@ async function uninstall(args) {
     }
   }
 
+  if (options.purge) {
+    for (const d of purgeDirs) {
+      if (options.dryRun) {
+        console.log(`  • ${d.label}`);
+        continue;
+      }
+      if (!fs.existsSync(d.path)) continue;
+      try {
+        fs.rmSync(d.path, { recursive: true, force: true });
+        console.log(`  Removed ${d.label}`);
+      } catch (e) {
+        console.warn(`  Warning: Could not remove ${d.label}: ${e.message}`);
+        hadErrors = true;
+      }
+    }
+  }
+
   // §4.8 State machine: uninstalling → uninstalled
-  saveConfig({
-    ...getConfig() || config,
-    mode: 'uninstalled',
-    uninstalled: new Date().toISOString(),
-    // Clean up manifest after successful uninstall
-    manifest: undefined
-  });
+  try {
+    saveConfig({
+      ...getConfig() || config,
+      mode: 'uninstalled',
+      uninstalled: new Date().toISOString(),
+      manifest: undefined,
+    });
+  } catch (e) {
+    // purge mode: config dir has been deleted, save is non-critical
+    if (!options.purge) throw e;
+    console.warn(`  Warning: Could not save config: ${e.message}`);
+  }
 
   // §4.12 Step 11: Clean up backup on success
   if (!hadErrors) {

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-07-08
-**Commit:** 509be7b
+**Commit:** 229cf7d
 **Branch:** main
-**Version:** 0.13.2.0
+**Version:** 0.14.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.